Splitting up Apache Logs for Subdomains<\/p>\n
\u00a01. Make sure your multiple virtual hosts log to the same log file.<\/p>\n
example:
@ your config file<\/p>\n
ErrorLog \u201c|\/usr\/sbin\/rotatelogs -l \/var\/log\/httpd\/linux\/error_log.%Y%m%d 86400?
CustomLog logs\/linux\/access_log combinedio
CustomLog \u201c|\/usr\/sbin\/rotatelogs -l \/var\/log\/httpd\/linux\/access_log.%Y%m%d 86400? combinedio<\/p>\n
2. Change your Apache LogFormat
from let say:
#LogFormat \u201c%h %l %u %t \\\u201d%r\\\u201d %>s %b \\\u201d%{Referer}i\\\u201d \\\u201d%{User-Agent}i\\\u201d” combined<\/p>\n
to:
LogFormat \u201c%V %h %l %u %t \\\u201d%r\\\u201d %>s %b \\\u201d%{Referer}i\\\u201d \\\u201d%{User-Agent}i\\\u201d \\\u201d%{HTTP_X_UP_CALLING_LINE_ID}e\\\u201d \\\u201d%{HTTP_X_WSB_IDENTITY}e\\ %I %O\u201d combinedio<\/p>\n
where: (use %V or %v based on your httpd.conf setting)
%V =the server name according to the UseCanonicalName setting
%v=the canonical ServerName of the server serving the request.<\/p>\n
3. Split your log files into its component parts and use the perl script \u201csplit-logfile. This program can be found in the support folder of your Apache distro.<\/p>\n
split-logfile < \/logs\/access_log<\/p>\n
You can create script to automate this, e.g.<\/p>\n
[root@dc1 log]# cat split.sh<\/p>\n
#!\/bin\/bash
#define
TODAY=`date \u201c+%Y%m%d\u201d`
YEST=`date \u201c+%Y%m%d\u201d -d\u201d1 day ago\u201d`
LOGPATH=\u201d\/var\/log\/httpd\/linux\u201d
ACCESSFILE=\u201d$LOGPATH\/access_log.$YEST\u201d
CURFOLDER=\u201d\/root\/log\u201d<\/p>\n
#split<\/p>\n
cd $CURFOLDER<\/p>\n
\/darwin\/log\/split-logfile < $ACCESSFILE<\/p>\n
echo $ACCESSFILE
#rename
\/usr\/bin\/rename log log.$YEST *log<\/p>\n
-> This script basically reads the rotated access log from the log path, and split the log files according to the server name<\/p>\n
Sample Results<\/p>\n
@original access logs<\/p>\n
[root@flt log]# ls -la \/var\/log\/httpd\/linux\/
total 544
drwxr-xr-x 2 root root 4096 Apr 20 16:07 .
drwx\u2014\u2014 3 root root 4096 Apr 18 04:02 ..<\/p>\n
-rw-r\u2013r\u2013 1 root root 103090 Apr 20 16:08 access_log
-rw-r\u2013r\u2013 1 root root 53770 Apr 13 18:11 access_log.20100420
-rw-r\u2013r\u2013 1 root root 48660 Apr 13 18:11 access_log.20100421
-rw-r\u2013r\u2013 1 root root 710 Apr 15 16:33 error_log.20100420
-rw-r\u2013r\u2013 1 root root 50 Apr 15 16:33 error_log.20100421<\/p>\n
@splitted log files after executing the script<\/p>\n
[root@dc1 log]# ls -la \/root\/log
total 292
drwxr-xr-x 2 root root 4096 Apr 21 01:01 .
drwxr-x\u2014 8 root root 4096 Apr 13 15:56 ..
-rw-r\u2013r\u2013 1 root root 9278 Apr 15 01:01 admin.linux.com.log.20100420
-rw-r\u2013r\u2013 1 root root 436 Apr 15 01:01 www.linux.com.log.20100420
-rw-r\u2013r\u2013 1 root root 1296 Apr 20 01:01 m.linux.com.log.20100420
-rw-r\u2013r\u2013 1 root root 6104 Apr 14 01:01 secure.linux.com.log.20100420<\/p>\n","protected":false},"excerpt":{"rendered":"
Splitting up Apache Logs for Subdomains<\/p>\n
1. Make sure your multiple virtual hosts log to the same log file.<\/p>\n
example:@ your config file<\/p>\n
ErrorLog \u201c|\/usr\/sbin\/rotatelogs -l \/var\/log\/httpd\/linux\/error_log.%Y%m%d 86400?CustomLog logs\/linux\/access_log combinedioCustomLog \u201c|\/usr\/sbin\/rotatelogs -l \/var\/log\/httpd\/linux\/access_log.%Y%m%d 86400? combinedio<\/p>\n
2. Change your Apache LogFormatfrom let say:#LogFormat \u201c%h %l %u %t \\\u201d%r\\\u201d %>s %b \\\u201d%{Referer}i\\\u201d \\\u201d%{User-Agent}i\\\u201d” combined<\/p>\n
to:LogFormat \u201c%V […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/1754"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1754"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/1754\/revisions"}],"predecessor-version":[{"id":1756,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/1754\/revisions\/1756"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}